RtlMarkHiberPhase
VOID __stdcall RtlMarkHiberPhase(){
_POP_HIBER_CONTEXT *v0;
unsigned int v1;
unsigned __int64 v2;
unsigned __int64 i;
NTSTATUS PhysicalAddress;
_LARGE_INTEGER v5;
unsigned __int64 v6;
UINT64 v7;
UINT64 v8;
NTSTATUS v9;
_LARGE_INTEGER v10;
ULONG *m;
__int64 v12;
unsigned __int64 v13;
unsigned __int64 v14;
void *v15;
int v16;
int *v17;
unsigned int v18;
__int64 j;
unsigned __int64 v20;
__int64 v21;
__int64 v22;
unsigned __int64 v23;
unsigned __int64 v24;
void *v25;
int v26;
int *v27;
unsigned int v28;
__int64 k;
unsigned __int64 v30;
__int64 v31;
__int64 v32;
unsigned __int64 v33;
unsigned __int64 v34;
ULONG *v35;
char *v36;
int v37;
int *v38;
unsigned int v39;
unsigned __int64 v40;
__int64 v41;
PVOID BugCheckParameter4;
_POP_HIBER_CONTEXT *v43;
int v44[2];
__int64 v45;
int v46[2];
__int64 v47;
int v48[2];
__int64 v49;
UINT64 Writable;
UINT64 v51;
_LARGE_INTEGER ReturnedPhysicalAddress;
_LARGE_INTEGER v53;
if( (KiBugCheckActive & 3) == 0 )
{
v0 = (_POP_HIBER_CONTEXT *)HiberContext;
v43 = (_POP_HIBER_CONTEXT *)HiberContext;
if( !HiberContext )
KeBugCheckEx(0xA0u, (PVOID)0x10B, (PVOID)(unsigned int)((_DWORD)HiberContext + 10), 0i64, 0i64);
v1 = *((_DWORD *)HiberContext + 46);
if( v1 == 8 )
{
v2 = (unsigned __int64)XpressHashFunction >> 12;
for( i = (unsigned __int64)"" >> 12; v2 < i; v2 += v7 )
{
LODWORD(Writable) = 0;
ReturnedPhysicalAddress.QuadPart = 0i64;
PhysicalAddress = MiGetPhysicalAddress((VOID *)(v2 << 12), &ReturnedPhysicalAddress, &Writable);
v5 = ReturnedPhysicalAddress;
v6 = v2 + 1;
v7 = 1i64;
if( !PhysicalAddress )
v5.QuadPart = 0i64;
v8 = (unsigned __int64)v5.QuadPart >> 12;
if( v6 < i )
{
do
{
LODWORD(v51) = 0;
v53.QuadPart = 0i64;
v9 = MiGetPhysicalAddress((VOID *)((v2 << 12) + (v7 << 12)), &v53, &v51);
v10 = v53;
if( !v9 )
v10.QuadPart = 0i64;
if( v8 - v2 + v6 != (unsigned __int64)v10.QuadPart >> 12 )
break;
++v7;
++v6;
}
while( v6 < i );
v0 = v43;
}
if( v0->MapFrozen )
{
IoAddTriageDumpDataBlock(
(VOID *)((unsigned __int64)v0 & 0xFFFFFFFFFFFFF000ui64),
(_BYTE *)((((unsigned __int16)v0 & 0xFFF) + 4551) & 0xFFFFF000));
v12 = *(&stru_140C452E0 + 718);
v44[0] = *(&stru_140C452E0 + 718);
v44[1] = 256;
v13 = (((unsigned __int64)&PopHiberInfo & 0xFFF) + 4311) >> 12;
v14 = (unsigned __int64)&PopHiberInfo & 0xFFFFFFFFFFFFF000ui64;
v45 = (__int64)&stru_140C452E0 + 2880;
if( v13 )
{
while( v14 >= 0x10000 && MmIsAddressValidEx(v14) )
{
v14 += 4096i64;
if( !--v13 )
goto LABEL_23;
}
}
else
{
LABEL_23:
m = &PopHiberInfo;
v15 = &unk_140C23518;
v16 = 0;
v17 = v44;
do
{
v18 = 0;
for( j = *((_QWORD *)v17 + 1); v18 < *v17; j += 16i64 )
{
v20 = *(_QWORD *)(j + 8);
if( (unsigned __int64)m < v20 && (unsigned __int64)v15 > *(_QWORD *)j )
{
if( (unsigned __int64)m < *(_QWORD *)j )
{
if( (unsigned __int64)v15 <= v20 )
v15 = *(void **)j;
}
else
{
if( (unsigned __int64)v15 <= v20 )
goto LABEL_36;
m = *(ULONG **)(j + 8);
}
}
++v18;
}
++v16;
v17 += 4;
}
while( !v16 );
if( (unsigned int)v12 < 0x100 )
{
v21 = 2 * v12;
LODWORD(v12) = v12 + 1;
*((_QWORD *)&stru_140C452E0 + v21 + 360) = m;
*((_QWORD *)&stru_140C452E0 + v21 + 361) = v15;
}
}
LABEL_36:
*(&stru_140C452E0 + 718) = v12;
if( KtriageDumpDataArray )
KeAddTriageDumpDataBlock(KtriageDumpDataArray, (ULONG)&PopHiberInfo, (PVOID)0xD8, (_SIZE_T)m);
v22 = *(&stru_140C452E0 + 718);
v46[0] = *(&stru_140C452E0 + 718);
v46[1] = 256;
v47 = (__int64)&stru_140C452E0 + 2880;
v23 = (((unsigned __int64)&PopAction & 0xFFF) + 4551) >> 12;
v24 = (unsigned __int64)&PopAction & 0xFFFFFFFFFFFFF000ui64;
if( v23 )
{
while( v24 >= 0x10000 && MmIsAddressValidEx(v24) )
{
v24 += 4096i64;
if( !--v23 )
goto LABEL_42;
}
}
else
{
LABEL_42:
m = &PopAction;
v25 = &unk_140C23428;
v26 = 0;
v27 = v46;
do
{
v28 = 0;
for( k = *((_QWORD *)v27 + 1); v28 < *v27; k += 16i64 )
{
v30 = *(_QWORD *)(k + 8);
if( (unsigned __int64)m < v30 && (unsigned __int64)v25 > *(_QWORD *)k )
{
if( (unsigned __int64)m < *(_QWORD *)k )
{
if( (unsigned __int64)v25 <= v30 )
v25 = *(void **)k;
}
else
{
if( (unsigned __int64)v25 <= v30 )
goto LABEL_55;
m = *(ULONG **)(k + 8);
}
}
++v28;
}
++v26;
v27 += 4;
}
while( !v26 );
if( (unsigned int)v22 < 0x100 )
{
v31 = 2 * v22;
LODWORD(v22) = v22 + 1;
*((_QWORD *)&stru_140C452E0 + v31 + 360) = m;
*((_QWORD *)&stru_140C452E0 + v31 + 361) = v25;
}
}
LABEL_55:
*(&stru_140C452E0 + 718) = v22;
if( KtriageDumpDataArray )
KeAddTriageDumpDataBlock(KtriageDumpDataArray, (ULONG)&PopAction, (PVOID)0x1C8, (_SIZE_T)m);
if( qword_140C23298 )
IoAddTriageDumpDataBlock(qword_140C23298, (_BYTE *)0x1D8);
if( HiberContext )
IoAddTriageDumpDataBlock(HiberContext, (_BYTE *)0x1C8);
v32 = *(&stru_140C452E0 + 718);
v48[0] = *(&stru_140C452E0 + 718);
v48[1] = 256;
v49 = (__int64)&stru_140C452E0 + 2880;
v33 = (((unsigned __int64)&PopCB & 0xFFF) + 4623) >> 12;
v34 = (unsigned __int64)&PopCB & 0xFFFFFFFFFFFFF000ui64;
if( v33 )
{
while( v34 >= 0x10000 && MmIsAddressValidEx(v34) )
{
v34 += 4096i64;
if( !--v33 )
goto LABEL_65;
}
}
else
{
LABEL_65:
v35 = &PopCB;
v36 = (char *)&stru_140C23628 + 264;
v37 = 0;
v38 = v48;
do
{
v39 = 0;
for( m = (ULONG *)*((_QWORD *)v38 + 1); v39 < *v38; m += 4 )
{
v40 = *((_QWORD *)m + 1);
if( (unsigned __int64)v35 < v40 && (unsigned __int64)v36 > *(_QWORD *)m )
{
if( (unsigned __int64)v35 < *(_QWORD *)m )
{
if( (unsigned __int64)v36 <= v40 )
v36 = *(char **)m;
}
else
{
if( (unsigned __int64)v36 <= v40 )
goto LABEL_78;
v35 = (ULONG *)*((_QWORD *)m + 1);
}
}
++v39;
}
++v37;
v38 += 4;
}
while( !v37 );
if( (unsigned int)v32 < 0x100 )
{
v41 = 2 * v32;
LODWORD(v32) = v32 + 1;
*((_QWORD *)&stru_140C452E0 + v41 + 360) = v35;
*((_QWORD *)&stru_140C452E0 + v41 + 361) = v36;
}
}
LABEL_78:
*(&stru_140C452E0 + 718) = v32;
if( KtriageDumpDataArray )
KeAddTriageDumpDataBlock(KtriageDumpDataArray, (ULONG)&PopCB, (PVOID)0x210, (_SIZE_T)m);
KeBugCheckEx(0xA0u, (PVOID)0x104, (PVOID)0xA, v0, 0i64);
}
PopSetBootPhaseRange(v0, v8, v7);
}
}
else if( v1 != 9 )
{
KeBugCheckEx(0xA0u, (PVOID)0x10B, (PVOID)0xA, (PVOID)v1, 0i64);
}
}
LODWORD(BugCheckParameter4) = 1936879704;
PoSetHiberRange(0i64, 0x10000ui64, XpressHighBitIndexTable, 0x100ui64, (UINT64)BugCheckParameter4);
}Referenced by:
PopMarkComponentsBootPhase